In gmc_mb_msg_handler of gmc_mba.c, there is a possible memory corruption due to a confused deputy. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
{ "severity": "High", "spl": "2026-09-05", "types": [ "EoP" ] }
"https://storage.googleapis.com/android-osv/PUB-A-508718430.json"